[dependabot]

Updates the requirements on fonttools to permit the latest version.

Release notes

Sourced from fonttools's releases.

4.68.0

• [feaLib] Escape " and \ when writing names back out with asFea() in FeatureNameStatement, STATNameStatement and CVParametersNameStatement (#4321).
• [scaleUpem] Also scale the MATH lengths that are not MathValueRecords (DelimitedSubFormulaMinHeight, DisplayOperatorMinHeight, MinConnectorOverlap, etc.) (#4327).
• [cffLib] Inherit the initial CFF2 vsindex from the Private DICT when decompiling, specializing and instancing charstrings, and fix programToCommands miscounting operands when several blend operators precede the first stem or moveto (#4337, #4339).
• [instancer] Round CFF2 outlines and stem hints on absolute positions rather than per relative operand, and keep CFF2 Private DICT blend values at full precision until they are written back (#4338, #4341).
• [cffLib] Preserve CFF2 Private DICT arrays that use more than one blend group (#4346).
• [feaLib] Raise FeatureLibError instead of looping forever on an unclosed OS/2, BASE or STAT table block (#4347).
• [designspaceLib] When a variable font overrides some public.fontInfo keys, merge them with the root-level font info instead of replacing it (#4336, #4340).
• [instancer] Raise an error for FeatureVariations conditions of a format other than the supported axis-range one, instead of silently dropping them (#4348).
• [filesystem] Don't overwrite an unrelated sibling .zip when writing a .ufoz or other non-.zip archive (#4342).
• [glyf] Fix exponential running time on composite glyphs that reuse the same component at several nesting levels; getCoordinates now raises TTLibError past 65535 composite points (#4325).
• [ttLib] Add support for the beyond-64k tables of the final ISO Open Font Format 5th edition: uppercase companion tables (GLYF, GVAR, HMTX, GSUB/GPOS extended layout, FeatureVariations 1.1, TTC 1.1/2.1, DMAP), a ttLib.beyond64k module and CLI, and support in FontBuilder, merge, subset, instancer, qu2cu, removeOverlaps and scaleUpem (#4097, #2678).
• [VARC] Keep addVarComponent() locations sparse, passing RESET_UNSPECIFIED_AXES via a new keyword-only resetUnspecifiedAxes pen argument (#4349).
• [woff] Require brotli >= 1.2.1 and brotlicffi >= 1.2.1.0, which fix GHSA-9v8h-qqgm-4m35 (#4365, #4370).
• Build Windows ARM64 wheels (#4366).
• [instancer] Fix AttributeError: ElidedFallbackNameID when updating font names of a font with a version 1.0 STAT table; fall back to the subfamily name (#2933, #4371).

Changelog

Sourced from fonttools's changelog.

4.68.0 (released 2026-10-27)

• [feaLib] Escape " and \ when writing names back out with asFea() in FeatureNameStatement, STATNameStatement and CVParametersNameStatement (#4321).
• [scaleUpem] Also scale the MATH lengths that are not MathValueRecord\ s (DelimitedSubFormulaMinHeight, DisplayOperatorMinHeight, MinConnectorOverlap, etc.) (#4327).
• [cffLib] Inherit the initial CFF2 vsindex from the Private DICT when decompiling, specializing and instancing charstrings, and fix programToCommands miscounting operands when several blend operators precede the first stem or moveto (#4337, #4339).
• [instancer] Round CFF2 outlines and stem hints on absolute positions rather than per relative operand, and keep CFF2 Private DICT blend values at full precision until they are written back (#4338, #4341).
• [cffLib] Preserve CFF2 Private DICT arrays that use more than one blend group (#4346).
• [feaLib] Raise FeatureLibError instead of looping forever on an unclosed OS/2, BASE or STAT table block (#4347).
• [designspaceLib] When a variable font overrides some public.fontInfo keys, merge them with the root-level font info instead of replacing it (#4336, #4340).
• [instancer] Raise an error for FeatureVariations conditions of a format other than the supported axis-range one, instead of silently dropping them (#4348).
• [filesystem] Don't overwrite an unrelated sibling .zip when writing a .ufoz or other non-.zip archive (#4342).
• [glyf] Fix exponential running time on composite glyphs that reuse the same component at several nesting levels; getCoordinates now raises TTLibError past 65535 composite points (#4325).
• [ttLib] Add support for the beyond-64k tables of the final ISO Open Font Format 5th edition: uppercase companion tables (GLYF, GVAR, HMTX, GSUB/GPOS extended layout, FeatureVariations 1.1, TTC 1.1/2.1, DMAP), a ttLib.beyond64k module and CLI, and support in FontBuilder, merge, subset, instancer, qu2cu, removeOverlaps and scaleUpem (#4097, #2678).
• [VARC] Keep addVarComponent() locations sparse, passing RESET_UNSPECIFIED_AXES via a new keyword-only resetUnspecifiedAxes pen argument (#4349).
• [woff] Require brotli >= 1.2.1 and brotlicffi >= 1.2.1.0, which fix GHSA-9v8h-qqgm-4m35 (#4365, #4370).
• Build Windows ARM64 wheels (#4366).
• [instancer] Fix AttributeError: ElidedFallbackNameID when updating font names of a font with a version 1.0 STAT table; fall back to the subfamily name (#2933, #4371).

4.67.0 (released 2026-10-14)

• [varLib] Support decreasing design-space axis mappings, via a new keyword-only allow_decreasing argument to models.normalizeValue (#3970, #4217, #4243).
• [designspaceLib] Allow partial DesignSpace v5 axis subsets: omitted range attributes

... (truncated)

Commits

• e1013ec Release 4.68.0
• 1a43bc6 Update NEWS.rst [skip ci]
• 095c3ed [instancer] Fall back to subfamily name for STAT 1.0 tables (#4371)
• 1ca5f77 Merge pull request #4372 from fonttools/dependabot/github_actions/pypa/gh-act...
• 7546d0c Bump pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3
• bf51d90 [setup.py] Raise woff minimums to brotli 1.2.1, brotlicffi 1.2.1.0 (#4370)
• 8d3eb2b Update brotli to v1.2.1 (#4365)
• afaa318 [ci] Build Windows ARM64 wheels (#4366)
• 2cb9ea7 [VARC] Keep pen component locations sparse (#4349)
• ceaf0b2 Merge pull request #4097 from fonttools/beyond-64k
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)